Re: [docs] [PATCH v2] Document shared state signing

["Antonin Godard" <antonin.godard@bootlin.com>]

Hi,

On Mon Apr 27, 2026 at 6:44 PM CEST, Quentin Schulz wrote:
[...]
>
>>> +            return True
>>>
>>>            import re
>>>            goodsigs = []
>>> @@ -145,6 +148,7 @@ class LocalSigner(object):
>>>
>>>            for sig in valid_sigs.split():
>>>                if sig in goodsigs:
>>> +                bb.note("Signature file %s successfully verified with key %s" % (sig_file, sig))
>>>                    return True
>>>            if len(goodsigs):
>>>                bb.warn('No accepted signatures found. Good signatures
>>> found: %s.' % ' '.join(goodsigs))
>>>
>>>
>>> ? I think we may have a few people resisting this as I'm guessing this
>>> is on the hot path so adding messages isn't the best (even if disabled
>>> most of the time).
>> 
>> I see what you mean. You might be a bit more convincing by passing them through
>> bb.debug?
>> 
>
> Sure, I randomly picked bb.note() but anything will do (though, does it 
> appear in the logs, which is what we're after after all?). Even 
> bb.debug() writes to the mainlogger, so I'm assuming there's *some* cost 
> even if it's not printed. Did you try? Does it work? (Because I just 
> wrote this without even running bitbake with it :D)

I tested this and this works fine. The messages will be printed when passing -v
to bitbake (verbose), so I guess bb.note is fine.

Maybe I'd re-organize a bit and do:

diff --git a/meta/lib/oe/gpg_sign.py b/meta/lib/oe/gpg_sign.py
index ede6186c84f..9024b349ef2 100644
--- a/meta/lib/oe/gpg_sign.py
+++ b/meta/lib/oe/gpg_sign.py
@@ -130,10 +130,6 @@ class LocalSigner(object):
 
         cmd += [sig_file]
         status = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-        # Valid if any key matches if unspecified
-        if not valid_sigs:
-            ret = False if status.returncode else True
-            return ret
 
         import re
         goodsigs = []
@@ -143,8 +139,18 @@ class LocalSigner(object):
             if s:
                 goodsigs += [s.group(1)]
 
+        # Valid if any key matches if unspecified
+        if not valid_sigs:
+            if status.returncode:
+                return False
+
+            bb.note("Signature file %s successfully verified with key(s): %s" %
+                    (sig_file, goodsigs))
+            return True
+
         for sig in valid_sigs.split():
             if sig in goodsigs:
+                bb.note("Signature file %s successfully verified with key %s" % (sig_file, sig))
                 return True
         if len(goodsigs):
             bb.warn('No accepted signatures found. Good signatures found: %s.' % ' '.join(goodsigs))

To show which key on the host verified our file. What do you think?

Antonin